Logging into a network service each time the service is used is considered an annoyance by users, although logging in ensures security via the credentials entered by the user. Several alternatives have arisen to help alleviate the user having to enter credentials on each log in. These alternatives have proven to be limited in utility or to introduce unacceptable insecurities into the login procedure.
As one example, network service providers have attempted to save user credentials on the subscriber device (either in plain text or in encrypted form). For instance, a user passphrase may be stored in a browser cookie or to a protected or encrypted data store of the subscriber device. However, doing so leaves open a vector of attack where a third party may retrieve the credentials from the subscriber device and reuse them for malicious purposes. As another example, service providers have attempted schemes using authentication tokens that are generated by a server upon login and that are only valid for a relatively short period of time. However, these temporary authentication tokens may be easily stolen and reused. As yet a further example, service providers have attempted approaches utilizing storage of information in a secure storage area or requesting simpler forms of identification from users, but these systems have proven to be insecure and easily compromised by those with physical access to a user's subscriber device.
In sum, current systems are unable to securely address user annoyance with repeated manual entry of user credentials in a way that preserves the security of network service login procedures.